Expanded FOCI Oversight Is Coming: What Defense Contractors Should Be Doing Now

On May 7, 2026, the Defense Acquisition Regulations System proposed amending the Defense Federal Acquisition Regulation Supplement (“DFARS”) to implement sections of the National Defense Authorization Act for Fiscal Years 2020 and 2021. This change seeks to mitigate risks related to beneficial ownership or foreign ownership, control, or influence (“FOCI”).

The proposed rule would apply to covered contractors and subcontractors with contracts or subcontracts valued in excess of $5 million, subject to exceptions. Although the rule has not yet been finalized, contractors should begin evaluating whether the proposal could affect future contract opportunities and compliance obligations.

Building Upon Department of Defense Instruction 5205.87

Historically, comprehensive FOCI reviews have largely been associated with contractors seeking or maintaining facility security clearances under the National Industrial Security Program. In 2024, Department of Defense Instruction (“DoDI”) 5205.87; Mitigating Risks Related to Foreign Ownership, Control, or Influence for Covered DoD Contractors and Subcontractors; expanded the Department’s policy by directing Department of War (“DoW”) Components to evaluate and mitigate certain FOCI risks affecting covered defense contractors, even when classified information was not involved.

The proposed DFARS rule implements that policy by establishing solicitation provisions and contract clauses that would require covered offerors to disclose FOCI information during the procurement process. Where DCSA identifies a mitigable FOCI or beneficial ownership risk, the contractor generally would be required to implement mitigation measures before award and, for certain post-award actions, before modification or option exercise.

Accordingly, contractors performing certain unclassified DoW work may encounter Defense Counterintelligence and Security Agency (“DCSA”)-administered FOCI review even if they have never previously participated in the National Industrial Security Program.

Which Contractors Could Be Affected?

The proposed rule would apply broadly to covered defense contractors and certain subcontractors performing contracts identified in the DFARS. While the rule includes exclusions for many commercial products and commercial services acquisitions, DoW retains authority to apply the requirements to acquisitions involving sensitive data, systems, or processes under specified circumstances.

Industry commentators have observed that the proposal could significantly expand the number of contractors subject to DCSA-administered FOCI review, extending oversight to many companies that have not previously been required to submit Standard Form 328 or otherwise engage with DCSA regarding FOCI issues.

Unanswered Questions Remain

Although the proposed rule establishes the overall framework for expanded FOCI oversight, several practical implementation issues remain unresolved.

Most notably, the proposal provides relatively little detail regarding the mitigation measures that may be required for contractors performing only unclassified work. Existing FOCI mitigation mechanisms have historically developed in the context of classified contracting, and the final rule may provide additional guidance regarding how mitigation will be implemented for contractors outside that environment.

Similarly, the proposal does not address how contractors should account for the costs associated with implementing FOCI mitigation measures, including potential governance changes, reporting obligations, or other compliance-related activities.

Implications for Prime Contractors and Their Supply Chains

The proposal would also increase prime contractor oversight responsibilities. Under the proposed DFARS clauses, covered requirements would flow down to subcontracts and other contractual instruments exceeding $5 million at any tier, subject to applicable exceptions. Prime contractors would also be required to confirm covered subcontractor National Industry Security System (“NISS”) eligibility before subcontract award and during performance.

As a result, contractors should evaluate whether existing subcontract management and supplier due diligence processes adequately account for potential FOCI compliance obligations.

Mergers, Acquisitions, and Investment Considerations

The proposed rule also reinforces the importance of evaluating FOCI considerations during corporate transactions involving defense contractors.

Changes in ownership, governance rights, foreign investment, or other corporate relationships may affect whether a contractor is required to make disclosures or implement mitigation measures under the final rule. Accordingly, FOCI considerations may become an increasingly important component of legal due diligence for acquisitions involving companies that perform covered DoW work, even where classified contracts are not involved.

Preparing for the Final Rule

Now that the comment period has closed, DoW will consider comments before issuing any final rule. However, contractors should not wait for a final rule to begin assessing potential impacts. Organizations performing DoW work should consider:

• reviewing current ownership and governance structures for potential FOCI considerations;
• identifying foreign ownership interests, beneficial ownership, and governance rights that could require disclosure;
• evaluating whether existing or anticipated contracts may fall within the scope of the proposed DFARS provisions;
• reviewing subcontractor management processes to determine whether future FOCI flowdown requirements may apply; and
• coordinating with counsel regarding transaction planning and organizational changes that could affect future compliance obligations.

Conclusion

The proposed DFARS rule represents a significant expansion of DoW’s FOCI oversight framework and reflects the Department’s continued emphasis on protecting the defense industrial base from foreign influence that could affect national security interests. By implementing the policy established in DoDI 5205.87, the proposal would extend FOCI disclosure and mitigation requirements to a substantially broader segment of contractors performing covered DoW work.

Although the scope and mechanics of the final rule may change as DoW completes the rulemaking process, contractors should monitor developments closely and begin evaluating how expanded FOCI requirements may affect their organizations, supply chains, and future contracting opportunities.